Xss::filter() damages attribute names with unconventional chars

Problem/Motivation

Xss::filter() damages attribute names with chars other than alphanumeric or dash.

E.g. <div data-x_y="hello"></div> becomes <div y="hello"></div>

I already reported this in a comment in #2544110-165: XSS attribute filtering is inconsistent and strips valid attributes, but I think it is useful to have a dedicated issue for reference.
This is also a place to have a patch that people can use to fix this issue specifically, without a full buy-in to the work from #2544110: XSS attribute filtering is inconsistent and strips valid attributes.

In the end, fixes for both issues will likely conflict.

See https://stackoverflow.com/a/53563849/246724 where allowed chars in attribute names are discussed.

Steps to reproduce

Call Xss::filter('<div data-x_y="hello"></div>').

Expected: One of:

• <div data-x_y="hello"></div>, if we want to keep the attribute.
• <div></div>, if we want to remove the attribute.

Actual: <div y="hello"></div>

Proposed resolution

Always parse the complete attribute name. Then decide whether to keep the attribute or not.
(I think in general we just keep it)

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet